Ben Laurie writes about OpenID being a phishing heaven. He says

“I had hoped that by constantly bringing this up the OpenID people might take some step to deal with the issue”

There have been, since October 2006, a set of defined OpenID security profiles. The lion part of the profiles have been incorporated into the core spec.

I believe the OpenID protocol partners (OP, RP, and user) can avoid the bulk of phishing issues by holding each other to certain pre-defined profiles.

But, I could be wrong, of course. Let’s say the security profiles don’t solve phishing issues.

However, the profiles are there to exactly handle such issues, and the opportunity to discuss them have been around for over three months…